Linux Mount Bind From Temp
This rule detects attempts to mount a bind from a temporary directory or other sensitive system directories on Linux systems. This behavior can be indicative of an attacker trying to hide malicious activity or gain persistence by mounting a bind from a compromised location to a system directory.
CQL
